CIA CIA Internal Controls & Audit 2 — Questions and Answers
Question 1: The Institute of Internal Auditors (IIA) Standards require internal auditors to maintain which quality characteristic above all others?
- Independence and objectivity (Correct answer)
- Technical accounting expertise
- Industry-specific certifications
- Relationship with external auditors
Correct answer: Independence and objectivity
IIA Standards mandate that internal auditors must be free from conditions that threaten their ability to perform their duties impartially.
Question 2: What is the purpose of an internal audit's 'risk-based audit plan'?
- To prioritize audit resources on the highest-risk areas of the organization (Correct answer)
- To list all financial accounts for annual review
- To schedule external auditor visits throughout the year
- To document past audit findings for reference
Correct answer: To prioritize audit resources on the highest-risk areas of the organization
A risk-based audit plan focuses limited internal audit resources where the potential for significant loss or non-compliance is greatest.
Question 3: When assessing internal controls over financial reporting (ICFR) under SOX Section 404, management must:
- Document and test the effectiveness of key controls and disclose any material weaknesses (Correct answer)
- Hire an external consultant to replace internal audit functions
- Submit quarterly ICFR reports directly to the IRS
- Only test IT-related controls within the organization
Correct answer: Document and test the effectiveness of key controls and disclose any material weaknesses
SOX Section 404 requires management to assess and report on the effectiveness of ICFR, and external auditors must attest to that assessment.
Question 4: An 'audit finding' in internal audit reports typically contains which four elements?
- Criteria, condition, cause, and effect (Correct answer)
- Input, process, output, and outcome
- Plan, do, check, and act
- Risk, control, test, and conclusion
Correct answer: Criteria, condition, cause, and effect
A well-structured audit finding states what should be (criteria), what is (condition), why it occurred (cause), and the impact (effect).
Question 5: Which internal control is most effective at preventing duplicate vendor payments?
- Three-way matching of purchase order, receiving report, and invoice (Correct answer)
- Monthly bank reconciliations only
- Annual external audit of accounts payable
- Restricting purchase authority to senior managers
Correct answer: Three-way matching of purchase order, receiving report, and invoice
Three-way matching verifies that the PO, receiving report, and invoice all agree before payment is authorized, preventing unauthorized or duplicate payments.
Question 6: The 'control self-assessment' (CSA) technique involves:
- Business unit employees evaluating the effectiveness of their own controls with audit facilitation (Correct answer)
- External auditors assessing management's performance annually
- Only IT staff reviewing cybersecurity controls
- The CFO certifying all financial statement controls personally
Correct answer: Business unit employees evaluating the effectiveness of their own controls with audit facilitation
CSA empowers process owners to assess their own controls, promoting ownership of risk management while the internal auditor facilitates the process.
CIA CIA Internal Controls & Audit 2
The Institute of Internal Auditors (IIA) Standards require internal auditors to maintain which quality characteristic above all others?